Privacy Policy

In this Privacy Policy, unless the context otherwise requires, the following capitalised expressions shall bear the meanings ascribed to them below:

1. (a)

   “Act” or “DPDP Act” means the Digital Personal Data Protection Act, 2023, and “DPDP Rules” means the Digital Personal Data Protection Rules, 2025 notified thereunder;

2. (b)

   “Applicable Law” means all laws, statutes, ordinances, rules, regulations, directions, notifications, orders and judgments of any competent authority in force in the Republic of India from time to time, including the Act, the DPDP Rules, the IT Act, the SPDI Rules, the Intermediary Rules and the CERT-In Directions, to the extent each is in force and applicable;

3. (c)

   “Board” means the Data Protection Board of India established under Section 18 of the Act;

4. (d)

   “CERT-In Directions” means the directions issued by the Indian Computer Emergency Response Team under Section 70B(6) of the IT Act on 28 April 2022, together with any clarifications or amendments thereto;

5. (e)

   “Child” means an individual who has not completed the age of eighteen (18) years;

6. (f)

   “Consent” means a free, specific, informed, unconditional and unambiguous indication of the Data Principal’s wishes, signifying, by a clear affirmative action, agreement to the Processing of Personal Data for the specified purpose, as contemplated by Section 6 of the Act;

7. (g)

   “Consent Manager” means a person registered with the Board under Section 6(9) of the Act who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw Consent through an accessible, transparent and interoperable platform;

8. (h)

   “Cookie Policy” means the Company’s cookie policy published at /cookie-policy, which forms part of this Privacy Policy;

9. (i)

   “Data Principal” means the individual to whom the Personal Data relates and, where such individual is a Child or a person with disability, includes the parent or lawful guardian, as the case may be;

10. (j)

    “Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of Processing of Personal Data;

11. (k)

    “Data Processor” means any person who Processes Personal Data on behalf of a Data Fiduciary;

12. (l)

    “Engagement” means any arrangement for the sourcing, development, customisation, white-labelling, sampling or supply of products between the Company and a User, governed by a quotation, proposal, purchase order, invoice or other written instrument issued or accepted by the Company (each, an “Engagement Document”);

13. (m)

    “Forms” means the “Start a project” brief form, the contact form and the vendor partner registration form made available on the Platform, together with any files uploaded through them;

14. (n)

    “Intermediary Rules” means the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;

15. (o)

    “IT Act” means the Information Technology Act, 2000;

16. (p)

    “Personal Data” means any data about an individual who is identifiable by or in relation to such data;

17. (q)

    “Personal Data Breach” means any unauthorised Processing of Personal Data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to Personal Data that compromises the confidentiality, integrity or availability of Personal Data;

18. (r)

    “Platform” means the website operated by the Company at voidra.co, its sub-domains and any successor domain designated by the Company, including all pages, Forms and features available thereon, excluding the restricted administrative area reserved for the Company’s personnel;

19. (s)

    “Processing” means a wholly or partly automated operation or set of operations performed on digital Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction, and “Process” and “Processed” shall be construed accordingly;

20. (t)

    “Services” means the services described in the Terms and Conditions, including the display of information and illustrative products on the Platform, the receipt and evaluation of project briefs, messages and vendor applications, and the preparation of quotations;

21. (u)

    “Sensitive Personal Data or Information” or “SPDI” has the meaning given to it in Rule 3 of the SPDI Rules, and “SPDI Rules” means the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;

22. (v)

    “Terms and Conditions” means the Company’s terms and conditions published at /terms-and-conditions; and

23. (w)

    “Vendor” means any manufacturer, supplier, artisan, printer, packer, logistics provider or other third party engaged or proposed to be engaged by the Company in connection with an Engagement.

Capitalised expressions used but not defined herein shall have the meanings ascribed to them in the Terms and Conditions or, failing that, in the Act or the IT Act.

In this Privacy Policy, unless the context otherwise requires:

1. (a)

   headings are inserted for convenience of reference only and shall not affect its construction or interpretation;

2. (b)

   words importing the singular include the plural and vice versa, and words importing a gender include every gender;

3. (c)

   the words “include”, “includes” and “including” shall be construed as being followed by the words “without limitation”;

4. (d)

   a reference to any statute, rule, regulation or statutory provision includes a reference to it as amended, modified, consolidated or re-enacted from time to time, and to any subordinate legislation made under it;

5. (e)

   a reference to a “person” includes any individual, company, firm, body corporate, partnership, trust, association, government or governmental authority, whether or not having separate legal personality;

6. (f)

   a reference to a clause or Schedule is a reference to a clause of, or Schedule to, this Privacy Policy, and the Schedules form an integral part hereof; and

7. (g)

   where any provision of the Act or the DPDP Rules has not yet commenced, every reference herein to such provision shall operate from the date of its commencement, and until such date the Company shall Process Personal Data in accordance with Section 43A of the IT Act and the SPDI Rules, which shall continue to apply for so long as they remain in force.

The Company records, for the purposes of clause 2.1(g), that the Act was brought into force in phases by notification dated 13 November 2025, such that the provisions relating to definitions and the Board are in force, the provisions relating to Consent Managers commence on 13 November 2026, and the substantive obligations of Data Fiduciaries and the rights and duties of Data Principals commence eighteen (18) months from such notification. The Company nonetheless adopts the standards set out herein with immediate effect, save where expressly stated otherwise.

This Privacy Policy applies to all Personal Data Processed by the Company through the Platform, including Personal Data furnished by the User through the Forms, collected automatically during the User’s access to the Platform, or received from the Data Processors identified in Schedule I in connection with the Platform.

This Privacy Policy does not apply to Personal Data Processed by the Company outside the Platform, including in the course of meetings, telephone calls, messaging applications or the performance of an Engagement, which shall be governed by the applicable Engagement Document and Applicable Law. It does not apply to any third-party website, application or service referred to in clause 17.

By accessing the Platform, submitting any Form or otherwise furnishing Personal Data to the Company, the User acknowledges that the User has read and understood this Privacy Policy and, where Consent is the ground for Processing under clause 5, signifies such Consent by such clear affirmative action.

Where the User does not agree with this Privacy Policy, the User shall not submit any Form or furnish any Personal Data. The consequence of non-acceptance is that the Company will be unable to respond to the User’s brief, message or vendor application, prepare a quotation, or otherwise provide the Services which depend on such Personal Data. The User may nevertheless browse the Platform without furnishing Personal Data, subject to the limited automatic Processing described in clause 4.3.

Where the User furnishes Personal Data on behalf of an organisation, or furnishes the Personal Data of any other individual (including colleagues, recipients of products or delivery contacts), the User represents and warrants that the User is duly authorised to do so and has provided such individual with the information contained in this Privacy Policy.

Personal Data furnished by the User. The Company collects the following Personal Data which the User voluntarily furnishes through the Forms:

1. (a)

   Project brief (“Start a project”): name; company or brand name (optional); links to the User’s website or social media profiles (optional, up to ten); role; email address; mobile or WhatsApp number; city; the category of person the User represents (such as brand, creator, corporate, retailer, event or wedding planner, hotel or hospitality); the product the User wishes to make; product category; indicative quantity; indicative budget per unit; date by which the products are needed; services required; delivery locations; any further information the User elects to provide; the source through which the User heard of the Company; any product or category pre-selected through a link on the Platform; and any reference images, design files or other files uploaded by the User;

2. (b)

   Contact form: name; email address; mobile number; and the content of the User’s message;

3. (c)

   Vendor partner registration: business name; contact person’s name; email address; mobile number; city; Goods and Services Tax Identification Number (optional); product categories manufactured or supplied; monthly capacity; minimum order quantity; website (optional); message (optional); and any catalogue, certification or product photographs uploaded by the User; and

4. (d)

   Correspondence: the contents of any email the User sends in reply to the Company’s acknowledgement emails or otherwise to the Company’s published email address.

The Company does not request, and the User shall not furnish through the Platform, any SPDI, including passwords, financial information such as bank account, credit card, debit card or other payment instrument details, physical, physiological or mental health condition, sexual orientation, medical records or biometric information. The Company does not collect payments through the Platform. Any SPDI contained in a file uploaded by the User shall be deemed to have been furnished contrary to this clause, and the Company shall be entitled to delete such file.

Personal Data collected automatically. When the User accesses the Platform, the following data is collected automatically:

1. (a)

   Server and request logs: the Internet Protocol (IP) address, browser user-agent, requested page path, date and time, response status and a request identifier, recorded by the Company’s hosting provider and by the Company’s application logs. The Company’s application logs are configured to mask email addresses and telephone numbers and to omit the contents of Forms;

2. (b)

   Abuse prevention: upon submission of a Form, a one-way cryptographic hash of the User’s IP address, combined with a secret value held by the Company, together with a submission count for a ten-minute window, used solely to limit repeated submissions;

3. (c)

   Bot detection: on pages containing a Form, Google reCAPTCHA v3 collects hardware and software information, such as device and application data, and interaction data, and returns to the Company a score and an action name, which the Company uses to determine whether the submission was made by a human;

4. (d)

   Cookie preference: a record of whether the User has accepted or declined analytics cookies, as described in the Cookie Policy;

5. (e)

   Analytics (only upon Consent): where the Company has enabled Google Analytics 4 and the User has selected “Accept” on the cookie banner, pseudonymous identifiers stored in cookies, pages viewed, referring source, approximate location derived from a truncated IP address, device and browser characteristics, and the following events: submission of a brief (with the category of person and product category selected), submission of the contact or vendor form, and clicks on WhatsApp or telephone links (with the location of the link on the Platform). Advertising storage, advertising user data and advertising personalisation signals are disabled; and

6. (f)

   Error diagnostics: where the Company has enabled error monitoring, technical information about errors occurring in the User’s browser or on the Company’s servers, including browser type, page path and stack traces, from which the Company’s configuration removes request bodies, cookies and query strings and masks email addresses and telephone numbers.

Personal Data obtained from third parties. The Company does not purchase Personal Data and does not obtain Personal Data about Users from data brokers. The Company receives from Google the reCAPTCHA assessment referred to in clause 4.3(c), from its email service provider delivery status information relating to emails sent to the User, and from referees, Vendors or business partners such information as they may lawfully share in connection with an enquiry.

Customer record. Upon submission of a brief, the Company creates or updates an internal customer record linking all briefs submitted with the same mobile number or, failing that, the same email address, and assigns each brief a reference number. No automated decision producing legal or similarly significant effects is made on the basis of such record.

The Company Processes Personal Data only for the purposes set out below, each mapped to the categories of Personal Data concerned and the ground on which such Processing is undertaken:

The Company shall not Process Personal Data for any purpose that is not specified in clause 5.1 or reasonably incidental thereto, save upon fresh Consent or as permitted by Applicable Law. The Company does not sell Personal Data, does not use Personal Data for targeted advertising or behavioural profiling, and does not send marketing communications to Users through the Platform.

This Privacy Policy, together with the notices displayed on each Form and on the cookie banner, constitutes the notice required under Section 5 of the Act and Rule 3 of the DPDP Rules. It itemises the Personal Data Processed (clause 4), the specified purposes and the goods or services enabled thereby (clause 5), the manner in which Consent may be withdrawn (clause 6.3), the manner in which the User may exercise the rights described in clause 13, and the manner in which the User may make a complaint to the Board (clause 16).

Manner of obtaining Consent. Consent is obtained by the User’s clear affirmative action, namely: (a) in respect of Forms, the act of submitting a Form after being presented with a notice referring to this Privacy Policy and the Terms and Conditions; and (b) in respect of analytics cookies, selecting “Accept” on the cookie banner. No analytics cookie is set unless and until “Accept” is selected, and the option to decline (“Essential only”) is presented with equal prominence.

Withdrawal of Consent. The User may withdraw Consent at any time with ease comparable to that with which it was given: (a) for analytics, by deleting the voidra_consent cookie or all cookies for the Platform through the browser settings, whereupon the cookie banner shall reappear and the User may select “Essential only”; and (b) for any other Processing, by writing to hello@voidra.co from the email address furnished to the Company. The Company shall cease, and cause its Data Processors to cease, Processing the relevant Personal Data within a reasonable time, unless such Processing is required or authorised under the Act or any other Applicable Law.

Consequences of withdrawal. Withdrawal of Consent shall not affect the legality of Processing undertaken prior to such withdrawal. Upon withdrawal, the Company may be unable to continue to evaluate the User’s brief or application, prepare or revise a quotation, or perform the Services dependent on such Personal Data, and any consequences of such withdrawal shall be borne by the User.

Consent Managers. Upon the commencement of Section 6(9) of the Act, the User may give, manage, review or withdraw Consent through a Consent Manager registered with the Board, where the Company makes such facility available. As at the date of this Privacy Policy, the Company has not integrated with any Consent Manager, and the mechanisms in clauses 6.2 and 6.3 shall apply.

The User may access this Privacy Policy in English. Upon the commencement of Section 5(3) of the Act, the User may request the contents of the notice in any language specified in the Eighth Schedule to the Constitution of India by writing to hello@voidra.co.

The Platform uses a limited number of cookies and similar technologies, which are classified, described and scheduled in the Cookie Policy. In summary: (a) a strictly necessary first-party cookie recording the User’s cookie preference; (b) strictly necessary cookies and technologies set by Google reCAPTCHA on pages containing a Form, for security; (c) authentication cookies used only within the restricted administrative area by the Company’s personnel; and (d) Google Analytics cookies, set only upon the User’s Consent.

The Platform’s own code does not use local storage, session storage or IndexedDB to store Personal Data, and does not employ device fingerprinting.

Data Processors. The Company engages the Data Processors identified in Schedule I to Process Personal Data on its behalf, solely for the functions specified therein. The Company engages such Data Processors under their applicable contractual terms and shall remain responsible, as Data Fiduciary, for Processing undertaken on its behalf in accordance with Section 8(2) of the Act.

Vendors. The Company may disclose to Vendors the product specifications, quantities, timelines, delivery locations and files contained in a brief, to the extent necessary to source, sample, cost, produce or deliver the products concerned. The Company shall disclose a User’s name and contact particulars to a Vendor only where necessary for the performance of an Engagement, such as for delivery.

Communication channels selected by the User. Where the User elects to contact the Company through WhatsApp by means of a link on the Platform, the User’s communication shall be Processed by WhatsApp in accordance with its own terms and privacy policy, and WhatsApp acts as an independent party and not as the Company’s Data Processor.

Disclosures required by law. Notwithstanding anything contained herein, the Company may disclose Personal Data, without the User’s Consent, to any government agency, statutory or regulatory authority, law enforcement agency, court or tribunal, where such disclosure is required or permitted under Applicable Law, including Section 69 or Section 70B of the IT Act, Rule 6 of the SPDI Rules, Section 7 or Section 17 of the Act, or pursuant to any order, summons or direction of a competent authority.

Corporate restructuring. In the event of any compromise, arrangement, merger, amalgamation, demerger, sale of all or a substantial part of the Company’s undertaking or assets, or any similar transaction, approved by a court, tribunal or other competent authority or otherwise permitted under Applicable Law, Personal Data may be transferred to the successor entity, which shall be bound by obligations no less protective than those set out herein. Such Processing is undertaken in accordance with Section 17(1)(e) of the Act, where applicable.

Professional advisers. The Company may disclose Personal Data to its legal advisers, auditors, chartered accountants and company secretaries, each of whom is bound by duties of confidentiality, to the extent necessary for the purposes set out in clause 5.1.

Personal Data Processed through the Platform is stored and Processed outside India by certain of the Data Processors identified in Schedule I, including in Singapore and the United States of America. The User acknowledges that the Company’s database and file storage are located in Singapore.

Such transfers are made in accordance with Section 16 of the Act and Rule 15 of the DPDP Rules (upon their commencement) and Rule 7 of the SPDI Rules. The Company shall not transfer Personal Data to any country or territory notified by the Central Government under Section 16(1) of the Act as one to which transfer is restricted, and shall comply with such requirements as the Central Government may specify by general or special order in respect of making Personal Data available to any foreign State or any person or entity under the control of a foreign State.

Where any sectoral or other Applicable Law provides for a higher degree of protection for, or restriction on, the transfer of Personal Data outside India, such law shall prevail.

The Company retains Personal Data only for so long as is necessary for the specified purpose, or as required for compliance with Applicable Law, as set out below:

Upon the expiry of the applicable period, upon the withdrawal of Consent, or upon a valid request for erasure under clause 13, whichever is earlier, the Company shall erase the Personal Data and cause its Data Processors to erase it, unless retention is necessary for compliance with Applicable Law. Erasure from backup and log systems maintained by Data Processors shall occur in accordance with their standard deletion cycles. The Company may retain data which has been irreversibly anonymised such that it no longer constitutes Personal Data.

The Company has implemented the following technical and organisational measures, commensurate with the nature of the Personal Data Processed, as reasonable security practices and procedures within the meaning of Section 43A of the IT Act and Rule 8 of the SPDI Rules, and as reasonable security safeguards within the meaning of Section 8(5) of the Act:

1. (a)

   transmission of all data between the User’s browser and the Platform over encrypted HTTPS connections, enforced by HTTP Strict Transport Security;

2. (b)

   storage of uploaded files in a private storage bucket that is not publicly accessible, with access granted to authorised personnel only through signed links which expire after a limited period;

3. (c)

   restriction of access to Personal Data held in the Company’s database to authenticated personnel holding an administrator role, with sign-in rate limiting, hashed passwords and expiring sessions, and with direct public access to database tables disabled;

4. (d)

   a content security policy and related browser security headers limiting the sources from which the Platform may load content;

5. (e)

   bot detection, honeypot fields and rate limiting on Forms, with IP addresses stored only in hashed form; and

6. (f)

   masking of email addresses and telephone numbers, and omission of Form contents, in application logs and error reports.

The Company relies upon the security measures maintained by its Data Processors in respect of the infrastructure operated by them. Notwithstanding the measures described above, no method of transmission over the internet or of electronic storage is entirely secure, and the Company does not warrant the absolute security of Personal Data. The Company shall review its security practices periodically and upon any material change to the Platform.

In the event of a Personal Data Breach, the Company shall, upon the commencement of Section 8(6) of the Act and Rule 7 of the DPDP Rules:

1. (a)

   intimate each affected Data Principal, without delay, in a concise, clear and plain manner through the email address or other contact particulars furnished by such Data Principal, describing the breach, including its nature, extent, timing and location of occurrence, the consequences relevant to the Data Principal that are likely to arise, the mitigation measures implemented or being implemented, the safety measures that the Data Principal may take, and the contact particulars of a person able to respond on behalf of the Company; and

2. (b)

   intimate the Board without delay and, within seventy-two (72) hours of becoming aware of the breach or such longer period as the Board may allow, furnish to the Board the updated and detailed information prescribed under the DPDP Rules.

Independently of clause 12.1, the Company shall report any cyber security incident of the types specified in the CERT-In Directions to the Indian Computer Emergency Response Team within six (6) hours of noticing such incident or of such incident being brought to its notice.

Subject to Applicable Law, and upon the commencement of the relevant provisions of the Act, the User, as Data Principal, shall be entitled to:

1. (a)

   access to information (Section 11): obtain a summary of the Personal Data being Processed and the Processing activities undertaken, the identities of all other Data Fiduciaries and Data Processors with whom the Personal Data has been shared together with a description of the Personal Data so shared, and such other information as may be prescribed;

2. (b)

   correction, completion, updating and erasure (Section 12): have inaccurate or misleading Personal Data corrected, incomplete Personal Data completed, Personal Data updated, and Personal Data erased where it is no longer necessary for the purpose for which it was Processed, unless retention is necessary for that purpose or for compliance with Applicable Law;

3. (c)

   grievance redressal (Section 13): have readily available means of grievance redressal in accordance with clause 16;

4. (d)

   nomination (Section 14): nominate any other individual who shall, in the event of the User’s death or incapacity, exercise the User’s rights in accordance with the Act and the DPDP Rules; and

5. (e)

   withdrawal of Consent (Section 6(4)): withdraw Consent in the manner set out in clause 6.3.

Pending such commencement, the User may, in accordance with Rule 5(6) of the SPDI Rules, review the information furnished by the User and request that any Personal Data found to be inaccurate or deficient be corrected or amended as feasible.

Procedure. The User may exercise any of the foregoing rights by writing to hello@voidra.co with the subject line “Data Principal request”, stating the right sought to be exercised and the brief reference number (where available), from the email address furnished to the Company or, where that is not possible, together with such information as the Company may reasonably require to verify the User’s identity. The Company may decline a request that it is unable to verify, or that is manifestly unfounded or excessive, or where compliance would contravene Applicable Law, and shall communicate the reasons for such refusal. The Company shall respond to a request within the period specified in clause 16.3.

The rights in clause 13.1 shall not apply to the extent exempted under Section 17 of the Act, including Processing necessary for the enforcement of any legal right or claim or for the prevention, detection, investigation or prosecution of any offence or contravention of law.

In accordance with Section 15 of the Act, the User shall:

1. (a)

   comply with the provisions of all Applicable Law while exercising rights under the Act;

2. (b)

   not impersonate another person while furnishing Personal Data for a specified purpose;

3. (c)

   not suppress any material information while furnishing Personal Data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;

4. (d)

   not register a false or frivolous grievance or complaint with the Company or the Board; and

5. (e)

   furnish only such information as is verifiably authentic while exercising the right to correction or erasure.

Breach of any duty under clause 14.1 may attract a penalty which may extend to ten thousand rupees under the Schedule to the Act. The Company shall be entitled to reject any request or grievance which is false, frivolous or furnished in breach of this clause, and shall not be liable for any consequence arising from false, inaccurate or incomplete Personal Data furnished by the User.

The Platform and the Services are directed at businesses and at individuals who have completed eighteen (18) years of age and are competent to contract. The Platform is not directed at Children, and the Company does not knowingly Process the Personal Data of any Child.

The Company shall not Process the Personal Data of a Child without the verifiable consent of the Child’s parent or lawful guardian obtained in accordance with Section 9(1) of the Act and Rule 10 of the DPDP Rules, and shall not undertake tracking or behavioural monitoring of Children or targeted advertising directed at Children.

Where the Company becomes aware that Personal Data of a Child has been furnished without such verifiable consent, the Company shall cease Processing and erase such Personal Data without undue delay, save to the extent retention is required under Applicable Law. Any person who believes that a Child has furnished Personal Data to the Company may write to hello@voidra.co.

Where Personal Data relates to a person with disability who has a lawful guardian appointed under Applicable Law, the Company shall Process such Personal Data only with the verifiable consent of such lawful guardian, in accordance with Section 9(1) of the Act and Rule 11 of the DPDP Rules.

In accordance with Section 8(10) and Section 13 of the Act, Rule 5(9) of the SPDI Rules and, to the extent applicable, Rule 3(2) of the Intermediary Rules, the Company has designated the following person as its Grievance Officer, who is also the person able to answer, on behalf of the Company, questions raised by Data Principals about the Processing of their Personal Data:

Grievances shall be submitted in writing by email with the subject line “Grievance”, setting out the particulars of the grievance and the User’s contact particulars.

The Grievance Officer shall acknowledge every grievance within twenty-four (24) hours of its receipt and shall dispose of it within thirty (30) days of its receipt or such shorter period as may be prescribed under Applicable Law, and in any event within the maximum period prescribed under Rule 14(3) of the DPDP Rules upon its commencement.

In accordance with Section 13(3) of the Act, the User shall exhaust the opportunity of redressing a grievance through the Company before approaching the Board. Upon such exhaustion, the User may file a complaint with the Data Protection Board of India in the manner prescribed under the Act and the DPDP Rules.

The Platform contains links to, and integrations with, services operated by third parties, including WhatsApp and Google. The Company does not control and is not responsible for the privacy practices or content of such third parties, whose Processing of Personal Data is governed by their own terms and privacy policies. The User is advised to review such policies before furnishing any Personal Data to them. Use of Google reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

The Company reserves the right to amend this Privacy Policy at any time to reflect changes in Applicable Law, in the Platform or in the Company’s Processing activities. The amended Privacy Policy shall be published on the Platform with a revised “Last updated” date and shall take effect from the date of such publication.

Where an amendment materially alters the purposes for which Personal Data is Processed on the basis of Consent, the Company shall seek fresh Consent, and where the Company holds the User’s email address and the amendment materially affects the User’s rights, the Company shall endeavour to notify the User by email. Continued use of the Platform after publication of an amendment shall constitute acknowledgement thereof, save where fresh Consent is required by Applicable Law.

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of India. Any dispute arising out of or in connection with this Privacy Policy shall be resolved in accordance with clause 19 (Governing Law and Dispute Resolution) of the Terms and Conditions, which is incorporated herein by reference, without prejudice to the User’s right to approach the Board under clause 16.4 or any other authority having jurisdiction under Applicable Law.

Questions concerning this Privacy Policy may be addressed to the Company at hello@voidra.co, +91 8851423071, or by post to the registered office stated above.